Implementing access control (Scalekit SaaSKit)

When to use

After authentication is working and the app must authorize access to routes/actions by inspecting the user's access token for roles and permissions.

Guardrails

• MUST validate the access token (expiry, issuer/audience) before trusting any decoded claims.
• MUST enforce role and permission checks server-side at the route boundary; MUST NOT rely on client-side authorization alone.
• MUST deny access (403) when a required role or permission is missing — never default to allow.

Prerequisites

• Auth is already working via implementing-saaskit / managing-saaskit-sessions (or equivalent).
• A Scalekit client is initialized (scalekit / scalekit_client) with env credentials — same as session middleware.
• Token storage matches that skill:
  • If cookies store encrypted tokens, keep using the app's decrypt(...) helper (app-owned, not a Scalekit API).
  • If cookies store the raw JWT (or clients send Authorization: Bearer), skip decrypt and use the raw string.
• Prefer reusing the existing session-validation middleware and adding role/permission guards on top rather than re-implementing crypto.